Maester Packs
HighBinary packFree

AD User Attributes

Checks that Active Directory users have the attributes HR processes, Entra Connect sync and address books depend on, that those values are formatted consistently, and that they use your approved values and office locations.

Version
0.3.2
Tests
25
Connectors
1
Published
9 Nov 2026

DevClate · devclate.ad-user-attributes · 0 stars · Open source · MIT

PowerShell 
Install-MtPack DevClate/maester-pack-adua

Install only packs from sources you trust. This pack is made by DevClate, not by Maester. The site only indexes and scans it: Install-MtPack downloads it straight from github.com/DevClate/maester-pack-adua.

maester-packs.lock.json entry 
{  "Id": "devclate.ad-user-attributes",  "Source": "DevClate/maester-pack-adua",  "Version": "0.3.2",  "Commit": "33e16c74cae035b3068786259858c0d71bfb2272",  "Digest": "sha256:7f38679dcfc7e7044b9b10fe36ad7ba32a1f3e34c026f48f49db2979f22b4a1a"}

← All tests

MP.CLT.ADUA.1021 Active Directory postal codes are on the approved list.

Severity: LowCLT.ADUA.Ldap

Checks that every postal code (postalCode) set on enabled Active Directory users is one of your approved values. Blank values are not checked here (the presence tests check those).

Postal codes identify offices for mail and emergency calling. A value typed slightly differently puts the user outside every group, rule and report built on the approved spelling.

The approved values come from postalCode in CLT.ADUA.AllowedValues under GlobalSettings in maester-config.json, from the file named in CLT.ADUA.AllowedValuesFile, or from this test's own AllowedValues, which replaces the shared list for this test only. When neither CLT.ADUA setting is set, the User Attributes pack's CLT.UA.AllowedValues is used, so one list can serve both packs. Until any are set, this test lists the values it finds and asks you to review them (Investigate) instead of failing.

Remediation action

  1. Review the values listed below and decide which are correct.

  2. Add the approved values to maester-config.json:

    { "GlobalSettings": { "CLT.ADUA.AllowedValues": { "postalCode": ["98052", "M5X 1A9"] } } }

  3. Change the users with a value that is not approved, in Active Directory Users and Computers (the user > Address > Zip/Postal Code) or with PowerShell: Set-ADUser -Identity <sAMAccountName> -PostalCode '98052'.

  4. If the value comes from an HR system or a provisioning tool, fix it there, or the next import overwrites your change.

  5. If a value is correct but not listed, add it to the approved values rather than changing the user.

Related links

%TestResult%